// This method gets called by the runtime. Use this method to add services to the container. public void ConfigureServices(IServiceCollection services) { services.Configure <CookiePolicyOptions>(options => { // This lambda determines whether user consent for non-essential cookies is needed for a given request. options.CheckConsentNeeded = context => true; options.MinimumSameSitePolicy = SameSiteMode.None; }); services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2); var a = OpenIdConnectDefaults.DisplayName; //OpenIdConnect services.AddAuthentication(options => { options.DefaultAuthenticateScheme = "Cookies"; //默认,没有登陆走oidc处理,即下面的OpenID Connect options.DefaultChallengeScheme = OpenIdConnectDefaults.DisplayName; //options.DefaultChallengeScheme = "oidc"; //options.DefaultAuthenticateScheme = "oidc"; }) .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme) .AddOpenIdConnect(OpenIdConnectDefaults.DisplayName, "OpenID Connect", options => { options.SignInScheme = "Cookies"; //options.SignInScheme = OpenIdConnectDefaults.DisplayName; options.Authority = "http://192.168.1.102:5001"; //授权服务器地址 options.RequireHttpsMetadata = false; options.ClientId = "oidc"; options.ClientSecret = "secret"; options.SaveTokens = true; //options.Scope.Add("openid"); //options.Scope.Add("profile"); //options.Scope.Add("email"); options.Scope.Add("offline_access"); options.Scope.Add("OtherInfo"); //api权限 options.ResponseType = OpenIdConnectResponseType.Code; // "id_token code";// OpenIdConnectResponseType.CodeIdToken; //注册事件 options.Events = new OpenIdConnectEvents { /* * 远程异常触发 * 在授权服务器取消登陆或者取消授权 */ OnRemoteFailure = OAuthFailureHandler => { //跳转首页 OAuthFailureHandler.Response.Redirect("/"); OAuthFailureHandler.HandleResponse(); return(Task.FromResult(0)); }, }; }); }
// This method gets called by the runtime. Use this method to add services to the container. public void ConfigureServices(IServiceCollection services) { services.Configure <CookiePolicyOptions>(options => { // This lambda determines whether user consent for non-essential cookies is needed for a given request. options.CheckConsentNeeded = context => true; options.MinimumSameSitePolicy = SameSiteMode.None; }); //配置DbContext services.AddDbContext <ApplicationDbContext>(options => { //配置文件前面必须是;ConnectionStrings //因为默认是:GetSection("ConnectionStrings")[name]. options.UseSqlServer(Configuration.GetConnectionString("conn")); //options.UseSqlServer(Configuration["Data:DefaultConnection:ConnectionString"])); }); services.AddIdentity <ApplicationUser, ApplicationRole>() .AddEntityFrameworkStores <ApplicationDbContext>() .AddDefaultTokenProviders(); services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2); //依赖注入初始化 services.AddAuthentication(options => { /* * 要想使用认证系统,必要先注册Scheme * 而每一个Scheme必须指定一个Handler * AuthenticationHandler 负责对用户凭证的验证 * 这里指定的默认认证是cookie认证 * Scheme可以翻译为方案,即默认的认证方案 * * 因为这里用到了多个中间件,(AddAuthentication,AddCookie,AddOpenIdConnect) * OpenIdConnectDefaults.DisplayName 的默认值是oidc * 指定AddOpenIdConnect是默认中间件,在AddOpenIdConnect配置了很多选项 * * 如果只用了一个中间件,则可以不写,是否还记得cookie认证 * // services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme) * // .AddCookie(option => * // { * // ///Account/Login?ReturnUrl=%2Fadmin * // option.LoginPath = "/login/index"; * // //option.ReturnUrlParameter = "params"; //指定参数名称 * // //option.Cookie.Domain * // option.AccessDeniedPath = "/login/noAccess"; * // option.Cookie.Expiration = TimeSpan.FromSeconds(4); * // option.Events = new CookieAuthenticationEvents * // { * // OnValidatePrincipal = LastChangedValidator.ValidateAsync * // }; * // }); * */ //options.DefaultScheme = "Cookies"; //默认的认证方案:cookie认证,信息是保存在cookie中的 options.DefaultAuthenticateScheme = "Cookies"; //oidc 就是openidConnect //名字随便取,只要AddOpenIdConnect中的的oidc名字一样即可, //这样才能找到,默认使用oidc //options.DefaultChallengeScheme = "oidc"; /* * 但我想,我的的网站没有登陆,跳转到自己的登陆页面, * 但用户可以指定第三方登陆,所以,这样不使用oidc,用的时候指定 * 使用myCookies中间件 */ options.DefaultChallengeScheme = "Cookies"; //options.DefaultChallengeScheme = "oidc"; //默认使用oidc中间件 //options.DefaultChallengeScheme = OpenIdConnectDefaults.DisplayName; }) .AddCookie("Cookies", options => { options.LoginPath = "/Account/Login"; }) .AddOAuth("OAuth", options => { options.SignInScheme = "Cookies"; options.ClientId = "OAuth.Client"; options.ClientSecret = "secret"; options.AuthorizationEndpoint = "http://localhost:5003/connect/authorize"; options.TokenEndpoint = "http://localhost:5003/connect/token"; options.CallbackPath = new PathString("/OAuth"); options.SaveTokens = true; options.Scope.Add("OAuth1"); options.Scope.Add("OAuth2"); options.Scope.Add("OAuth3"); //options.Scope.Add("offline_access"); options.Events = new OAuthEvents() { //远程异常触发 OnRemoteFailure = OAuthFailureHandler => { //var msg = OAuthFailureHandler.Failure.Message; var authProperties = options.StateDataFormat.Unprotect(OAuthFailureHandler.Request.Query["state"]); var redirectUrl = authProperties.RedirectUri; if (redirectUrl.Contains("/")) { redirectUrl = string.Format($"{redirectUrl.Substring(0, redirectUrl.LastIndexOf("/") + 1)}#");// redirectUrl.Substring(0, redirectUrl.IndexOf("/") + 1); } //"http://localhost:5001/#" OAuthFailureHandler.Response.Redirect(redirectUrl); OAuthFailureHandler.HandleResponse(); return(Task.FromResult(0)); } }; }) //.AddGoogle("googole", options => { // options.ClientId = ""; // options.ClientSecret = ""; //}) .AddOpenIdConnect("oidc", "OpenID Connect", options => { //options.SignOutScheme = OpenIdConnectDefaults.DisplayName; options.SignInScheme = "Cookies"; //options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme; //options.SignOutScheme = IdentityServerConstants.SignoutScheme; //默认值start //options.CallbackPath = new PathString("/signin-oidc"); //options.SignedOutCallbackPath = new PathString("/signout-callback-oidc"); //options.RemoteSignOutPath = new PathString("/signout-oidc"); //options.Scope.Add("openid"); //options.Scope.Add("profile"); //options.ResponseMode = OpenIdConnectResponseMode.FormPost; //默认值end options.Authority = "http://localhost:5003"; options.RequireHttpsMetadata = false; options.ClientId = "oidc"; options.ClientSecret = "secret"; options.SaveTokens = true; /* * 这样会去请求UserInfoEndpoint获取到信息后绑定到User.Claims * 同时access_token也会有 */ //options.GetClaimsFromUserInfoEndpoint = true; //options.ClaimActions.MapJsonKey("sub", "sub"); //options.ClaimActions.MapJsonKey("preferred_username", "preferred_username"); //options.ClaimActions.MapJsonKey("avatar", "avatar"); //options.ClaimActions.MapCustomJson("role", job => job["role"].ToString()); //////////////////////////////////// //options.Scope.Add("OAuth1"); options.Scope.Add("offline_access"); options.Scope.Add("OtherInfo"); options.Scope.Add("email"); /* * 默认值是:id_token */ options.ResponseType = "id_token code";// OpenIdConnectResponseType.CodeIdToken; options.Events = new OpenIdConnectEvents { //OnMessageReceived = received => { // received.HttpContext.ChallengeAsync("oidc"); // received.HandleResponse(); // return Task.FromResult(0); //}, //OnRedirectToIdentityProviderForSignOut = re => { // var ck =await re.HttpContext.AuthenticateAsync(); //}, /* * 远程异常触发 * 在授权服务器取消登陆或者取消授权 */ OnRemoteFailure = OAuthFailureHandler => { //跳转首页 OAuthFailureHandler.Response.Redirect("/"); OAuthFailureHandler.HandleResponse(); return(Task.FromResult(0)); }, //未授权时,重定向到OIDC服务器时触发 //OnRedirectToIdentityProvider = identity => { // //这里不跳转到授权服务器,跳转到登陆页面 // identity.Response.Redirect("/Account"); // identity.HandleResponse(); // return Task.FromResult(0); //} }; }); #region OAuth认证 //services.AddAuthentication(options => //{ // //options.DefaultAuthenticateScheme=OAuthDefaults.DisplayName // //options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme; // options.DefaultAuthenticateScheme = "Cookies"; // options.DefaultSignInScheme = "Cookies"; // //options.DefaultSignOutScheme = "Cookies"; // options.DefaultChallengeScheme = "OAuth"; //}) //.AddCookie() //.AddOAuth("OAuth", options => //{ // options.ClientId = "OAuth.Client"; // options.ClientSecret = "secret"; // options.AuthorizationEndpoint = "http://localhost:5003/connect/authorize"; // options.TokenEndpoint = "http://localhost:5003/connect/token"; // options.CallbackPath = new PathString("/OAuth"); // options.SaveTokens = true; // options.Scope.Add("OAuth1"); // options.Scope.Add("OAuth2"); // options.Scope.Add("OAuth3"); // //options.Scope.Add("offline_access"); // options.Events = new OAuthEvents() // { // //OnRedirectToAuthorizationEndpoint = t => // //{ // // t.Response.Redirect("http://localhost:5001/Account/userinfo"); // // return Task.FromResult(0); // //}, // //远程异常触发 // OnRemoteFailure = OAuthFailureHandler => // { // //var msg = OAuthFailureHandler.Failure.Message; // var authProperties = options.StateDataFormat.Unprotect(OAuthFailureHandler.Request.Query["state"]); // var redirectUrl = authProperties.RedirectUri; // if (redirectUrl.Contains("/")) // { // redirectUrl = string.Format($"{redirectUrl.Substring(0, redirectUrl.LastIndexOf("/") + 1)}#");// redirectUrl.Substring(0, redirectUrl.IndexOf("/") + 1); // } // //"http://localhost:5001/#" // OAuthFailureHandler.Response.Redirect(redirectUrl); // OAuthFailureHandler.HandleResponse(); // return Task.FromResult(0); // } // }; //}); #endregion }
// This method gets called by the runtime. Use this method to add services to the container. public void ConfigureServices(IServiceCollection services) { #region 解释记载 // services.AddAuthentication(option => // { // /* // 要想使用认证系统,必要先注册Scheme // 而每一个Scheme必须指定一个Handler // AuthenticationHandler 负责对用户凭证的验证 // 这里指定的默认认证是cookie认证 // Scheme可以翻译为方案,即默认的认证方案 // */ // option.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme; // //option.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme; // //option.DefaultChallengeScheme = OAuthDefaults.DisplayName; // /* // 因为这里用到了多个中间件,(AddAuthentication,AddCookie,AddOAuth) // 所以要设置一个默认中间件OAuthDefaults.DisplayName 的默认值是OAuth // 指定AddOAuth是默认中间件,在AddOAuth配置了很多选项 // 如果只用了一个中间件,则可以不写,是否还记得cookie认证 // services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme) // .AddCookie(option => // { // ///Account/Login?ReturnUrl=%2Fadmin // option.LoginPath = "/login/index"; // //option.ReturnUrlParameter = "params"; //指定参数名称 // //option.Cookie.Domain // option.AccessDeniedPath = "/login/noAccess"; // option.Cookie.Expiration = TimeSpan.FromSeconds(4); // option.Events = new CookieAuthenticationEvents // { // OnValidatePrincipal = LastChangedValidator.ValidateAsync // }; // }); // */ // option.DefaultChallengeScheme = OAuthDefaults.DisplayName; // }) //.AddCookie() //.AddOAuth(OAuthDefaults.DisplayName, //option => { // option.ClientId = "oauth"; // option.ClientSecret = "secret"; // option.AuthorizationEndpoint = "http://localhost:5000/connect/authorize"; // option.TokenEndpoint = "http://localhost:5000/connect/token"; // option.CallbackPath = "/signin-oauth"; // //option.Scope.Clear(); // option.Scope.Add("api"); // // 事件执行顺序 : // // 1.创建Ticket之前触发 // //option.Events.OnCreatingTicket = context => Task.CompletedTask; // // 2.创建Ticket失败时触发 // //option.Events.OnRemoteFailure = context => Task.CompletedTask; // // 3.Ticket接收完成之后触发 // //option.Events.OnTicketReceived = context => Task.CompletedTask; // // 4.Challenge时触发,默认跳转到OAuth服务器 // // options.Events.OnRedirectToAuthorizationEndpoint = context => context.Response.Redirect(context.RedirectUri); // }); #endregion services.AddMvc(); services.AddAuthentication(options => { //options.DefaultAuthenticateScheme=OAuthDefaults.DisplayName //options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme; options.DefaultAuthenticateScheme = "Cookies"; options.DefaultSignInScheme = "Cookies"; options.DefaultChallengeScheme = "OAuth"; }) .AddCookie() .AddOAuth("OAuth", optins => { optins.ClientId = "OAuth.Client"; optins.ClientSecret = "secret"; optins.AuthorizationEndpoint = "http://localhost:5000/connect/authorize"; optins.TokenEndpoint = "http://localhost:5000/connect/token"; optins.SaveTokens = true; optins.CallbackPath = "/Account/PostAuthorize"; optins.Scope.Add("OAuth1"); optins.Scope.Add("OAuth2"); optins.Scope.Add("OAuth3"); optins.Events = new OAuthEvents() { //OnRemoteFailure = HandleOnRemoteFailure, //远程异常触发 OnRemoteFailure = OAuthFailureHandler => { var msg = OAuthFailureHandler.Failure.Message; var authProperties = optins.StateDataFormat.Unprotect(OAuthFailureHandler.Request.Query["state"]); var redirectUrl = authProperties.RedirectUri; if (redirectUrl.Contains("/")) { redirectUrl = string.Format($"{redirectUrl.Substring(0, redirectUrl.LastIndexOf("/") + 1)}#");// redirectUrl.Substring(0, redirectUrl.IndexOf("/") + 1); } //"http://localhost:5001/#" OAuthFailureHandler.Response.Redirect(redirectUrl); OAuthFailureHandler.HandleResponse(); return(Task.FromResult(0)); } }; }); }
// This method gets called by the runtime. Use this method to add services to the container. public void ConfigureServices(IServiceCollection services) { // services //.TryAddSingleton<IHttpContextAccessor, HttpContextAccessor>(); /* * 注意:注册的更好方法IHttpContextAccessor是调用AddHttpContextAccessor Extension方法, */ //services.AddHttpContextAccessor(); //services.AddHttpClient(); //services.Configure<AuthServiceSettings>(Configuration); //services.add services.AddSingleton(serviceProvider => { var configuration = serviceProvider.GetRequiredService <IConfiguration>(); return(configuration.GetSection("AuthServiceSettings")); }); services.AddSingleton <IDiscoveryCache>(serviceProvider => { //var authServiceConfig = serviceProvider.GetRequiredService<AuthServiceSettings>(); //var factory = serviceProvider.GetRequiredService<IHttpClientFactory>(); //return new DiscoveryCache(authServiceConfig.Authority, () => factory.CreateClient()); //var factory = serviceProvider.GetRequiredService<IHttpClientFactory>(); return(new DiscoveryCache("http://localhost:5008")); }); services .AddTransient <CustomCookieAuthenticationEvents>() .AddTransient <ITokenRefresher, TokenRefresher>() .AddTransient <AccessTokenHttpMessageHandler>() .AddTransient <HttpClient>() .AddHttpContextAccessor(); //services // .AddHttpClient<ITokenRefresher, TokenRefresher>(); //JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear(); /* * Add-Migration init -Context InfoDbContext * Update-Database -Context InfoDbContext */ var migrationAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name; services.AddControllersWithViews(); services.AddDbContext <InfoDbContext>(_ => { _.UseSqlServer(Configuration.GetConnectionString("InfoDb")); }); var oidc = OpenIdConnectDefaults.DisplayName; //OpenIdConnect var cookie = CookieAuthenticationDefaults.AuthenticationScheme; services.AddAuthentication(options => { /* * 使用cookie作为本地登录用户 */ options.DefaultScheme = cookie; /* * 当需要用户登录时,我们将使用cookie协议 * 将会执行AddCookie()的处理程序 */ options.DefaultChallengeScheme = cookie; /* * 指定oidc为默认登录方式 * 也就是说没有授权则执行oidc的Handler */ //options.DefaultChallengeScheme = "oidc"; //options.DefaultAuthenticateScheme = "Cookies"; //默认,没有登陆走oidc处理,即下面的OpenID Connect //options.DefaultChallengeScheme = OpenIdConnectDefaults.DisplayName; //options.DefaultChallengeScheme = "oidc"; //options.DefaultAuthenticateScheme = "oidc"; }) .AddCookie(cookie, options => { /* * 第三方登录成功,没有设置cookie过期时间 * 那么该cookie是会话级别的。即。浏览器不关闭,会一直在线 */ options.LoginPath = "/account"; //options.ExpireTimeSpan = TimeSpan.FromSeconds(30); //options.EventsType = typeof(CustomCookieAuthenticationEvents); }) // .AddMicrosoftAccount(microsoftOptions => //{ // //https://www.netnr.com/home/list/109 // microsoftOptions.ClientId = Configuration["Authentication:Microsoft:ClientId"]; // microsoftOptions.ClientSecret = Configuration["Authentication:Microsoft:ClientSecret"]; //}) .AddGitHub(GitHubDefaults.AuthenticationScheme, GitHubDefaults.DisplayName, options => { options.ClientId = "8b4e1c7979b3b9705109"; options.ClientSecret = "643aa3afb7b5a5d7e38685dd8be308278fc506d5"; }) //.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme,options => //{ // //options.LoginPath = new PathString(Constants.SignIn); // //options.LogoutPath = new PathString(Constants.SignOut); // options.Cookie.SameSite = Microsoft.AspNetCore.Http.SameSiteMode.None; //}) //.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme) //openid connect协议的处理程序 .AddOpenIdConnect(oidc, "OpenID Connect", options => { var authServiceConfig = Configuration.Get <AuthServiceSettings>(); var app = Configuration.Get <AuthServiceSettings>(); //options.SignInScheme = "Cookies"; //options.SignInScheme = OpenIdConnectDefaults.DisplayName; options.Authority = "http://localhost:5008"; //授权服务器地址 options.RequireHttpsMetadata = false; options.ClientId = "5440496238"; options.ClientSecret = "saQR67zTYy"; //来自identityserver的令牌持久化在cookie中 options.SaveTokens = true; /* * 指示身份验证会话生存期(例如cookies)应匹配 * * 身份验证令牌的。如果令牌不提供生存期信息 * * 然后将使用正常会话生存期。这在默认情况下是禁用的。 */ //options.UseTokenLifetime = true; // options.JwtValidationClockSkew = TimeSpan.FromSeconds(0); //options.AccessDeniedPath = ""; //options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters //{ //}; //options.Scope.Clear(); //这会删除所有默认的scope //options.AccessDeniedPath //定义远程登录取消页面?? //options.Scope.Add("openid"); //options.Scope.Add("profile"); //向服务器发起,我想要的权限和用户信息,前提的服务器允许 //options.Scope.Add("email"); options.Scope.Add(OidcConstants.StandardScopes.OfflineAccess); //options.Scope.Add("offline_access"); options.Scope.Add("comment"); //api权限 //options.Scope.Add("info"); //options.ResponseType = OpenIdConnectResponseType.Code;// "id_token code";// OpenIdConnectResponseType.CodeIdToken; //或者 options.ResponseType = ResponseTypes.Code; /* * 这样会去请求UserInfoEndpoint获取到信息后绑定到access_token中 */ options.GetClaimsFromUserInfoEndpoint = true; /* * 通过ClaimActions.MapJsonKey("自定义key名","JwtClaimTypes.Subject") * 把ProfileService返回的Claims映射到User.Claims * 前提是GetClaimsFromUserInfoEndpoint=true */ options.ClaimActions.MapJsonKey("sub89", "sub"); options.ClaimActions.MapJsonKey("subject", JwtClaimTypes.Subject); //options.ClaimActions.MapJsonKey("preferred_username", "preferred_username"); //options.ClaimActions.MapJsonKey("email", "email"); //options.ClaimActions.MapJsonKey("name", "name"); options.ClaimActions.MapCustomJson("role", jobject => jobject.GetString("role")); options.ClaimActions.MapCustomJson("所有Claim", all => all.ToString()); //options.CallbackPath = $"/signin-oidc-{provider.Key}"; //options.SignedOutCallbackPath = $"/signout-callback-oidc-{provider.Key}"; //options.SignedOutCallbackPath = "/signin-oidc/home"; //注册事件 options.Events = new OpenIdConnectEvents { /* * 远程异常触发 * 在授权服务器取消登陆或者取消授权 */ OnRemoteFailure = OAuthFailureHandler => { //跳转首页 OAuthFailureHandler.Response.Redirect("/"); OAuthFailureHandler.HandleResponse(); return(Task.FromResult(0)); }, //https://blog.codingmilitia.com/2019/06/22/aspnet-024-from-zero-to-overkill-integrating-identityserver4-part4-back-for-front //在重定向到身份提供程序进行身份验证之前调用 //OnRedirectToIdentityProvider = context => //{ // /* // 如果是SPA页面,直接请求某个页面,可以捕获 // */ // if (!context.HttpContext.Request.Path.StartsWithSegments("/auth/login")) // { // context.HttpContext.Response.StatusCode = 401; // context.HandleResponse(); // } // return Task.CompletedTask; //} }; }); }